# Leya Privacy Notice

Version 2026-10 · Last updated: 18 October 2026

This notice explains which personal data we process for your Leya account and the Leya apps (mimosa, Lotus, Trellis and others), why, and how.

## 1. Controller

Yusuf Melih Bozgeyik, who operates the Leya Production brand. Contact: support@leyaproduction.com

## 2. What we don't process

Your documents, notes, drawings, recordings (Echo) and everything else you create in the apps are **never sent to Leya's servers**. They stay on your device and in the cloud storage you choose (iCloud or Google Drive). Sync happens directly between the app and your own cloud account. We have no access to this content.

We never see your Apple or Google password or your payment card details.

## 3. The personal data we process

| Category | Data | Source |
|---|---|---|
| Identity and contact | Your Leya account ID; the provider you sign in with (Apple or Google); that account's email address (Apple's relay address if you chose "Hide My Email"); the name the provider gives | Signing in with Apple or Google |
| Profile | Username, display name, the preset avatar you chose | What you enter |
| Records of accepted agreements | The document accepted, its version and language; when and how it was accepted; IP address; client details; app and version; platform; device language | When you create your account and accept new versions |
| Security and integrity | An app-specific device identifier, device model, app version, IP address, the results of Google Play Integrity / Apple App Attest / Firebase App Check checks, security events and the account's status (active / suspended) | Automatic checks when the apps start |
| Subscriptions | Subscription status, product, start and end dates, purchase history (no payment details) | App Store, Google Play and our subscription provider (RevenueCat) |
| Correspondence | Emails you send us for support | Emails you send |

## 4. Purposes and legal bases

| Purpose | Legal basis (GDPR Art. 6(1); KVKK Art. 5(2)) |
|---|---|
| Creating your account, signing you in, showing your profile and username across the Leya apps | Performance of a contract |
| Linking your subscriptions and purchases to your account | Performance of a contract |
| Keeping a record that you accepted the Terms of Use and emailing you a copy | Performance of a contract; establishing, exercising or defending legal claims |
| Verifying that the app is genuine and the device is secure; detecting and preventing piracy, cracking attempts and abuse; suspending accounts that break the Terms | Legitimate interests (protecting our software, our users and our service); performance of a contract (Terms of Use, sections 4–6) |
| Building evidence and pursuing legal claims after a breach | Establishing, exercising or defending legal claims; legitimate interests |
| Answering support requests | Performance of a contract; legitimate interests |
| Meeting legal obligations and lawful requests from authorities | Legal obligation |

We don't use your personal data for advertising or profiling, and we don't sell it. We don't send you marketing messages; if we ever want to, we will ask for your consent first.

## 5. Who receives your data

Your personal data is shared with the following service providers so that we can run the service. Some of them are outside your country.

| Recipient | Purpose | Location |
|---|---|---|
| Google (Firebase Authentication, Cloud Firestore, Cloud Functions, App Check, Play Integrity) | Account, profile, records and security checks | Data stored in the EU (Belgium, europe-west1); Google is based in the US |
| Apple (Sign in with Apple, App Attest) | Sign-in and integrity checks on iOS | US / Ireland |
| RevenueCat | Linking subscription status to your account | US |
| Resend | Sending the agreement emails | EU (Ireland); the company is based in the US |
| Apple iCloud Mail | Archiving support emails and records of accepted agreements in the controller's mailbox | US / Ireland |
| Telegram | Instantly notifying the controller of security events (account ID, username, event type) | United Arab Emirates |
| Competent authorities and courts | Where required by law and for legal claims | Where applicable |

International transfers are made under appropriate safeguards, such as the European Commission's and the Turkish Personal Data Protection Board's standard contractual clauses.

## 6. How long we keep it

| Data | Period |
|---|---|
| Account, profile and subscription data | Until you delete your account |
| Device and session records | Until you delete your account |
| Records of accepted agreements | 10 years from acceptance (the general limitation period), even if the account is deleted |
| Security events | 2 years; if linked to a breach or dispute, until it is resolved and the limitation period has passed. Identifying details are removed from events when the account is deleted. |
| Support correspondence | 2 years after the request is resolved |

When a period ends, the data is deleted, destroyed or anonymized.

## 7. Your rights

Depending on where you live, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and not to be subject to a decision based solely on automated processing that significantly affects you.

An automatic suspension after a security check is such a decision. You can appeal it as described in section 7 of the Terms of Use, and a person will review your appeal.

To exercise your rights, write to support@leyaproduction.com from the email address linked to your Leya account. We will respond within 30 days, free of charge. You also have the right to lodge a complaint with your data protection authority (in Türkiye, the Personal Data Protection Board; in the EU, the supervisory authority where you live).

## 8. Security

Your data is kept on servers with restricted access and encrypted connections. The apps can read and change account data only for your own account. Critical records (account status, security events, records of accepted agreements) are written only by our servers and cannot be changed afterwards.

## 9. Children

Leya accounts are not for children under 13. If we learn that we hold data about a child under 13, we will delete it.

## 10. Changes

We may update this notice. When we make a significant change, we will show the new version in the app. Every version is archived on leyaproduction.com with its version number.

## 11. Language

The Turkish version of this notice applies to users in Türkiye; this English version applies to all other users.